Snapshot protection and its role in clone safety

Intermediate⏱ ~15 minrbd

What you'll learn

Protect and unprotect snapshots
Explain why clones require protection
Manage protection through template versioning
Resolve an unprotect blocked by children

Prerequisites

None — start here.

Verified against Ceph Tentacle 20.2.x · Ceph Squid 19.2.x (supported previous) · cephadm matches the verified Ceph release · podman 4.x · csi-rbd and csi-cephfs current · RBD / CephFS / RGW current (matches Ceph release) · Linux kernel 5.15+ (5.10 minimum) · Ubuntu 24.04 LTS (Ceph host baseline) · Debian 12 (Bookworm) (Ceph host baseline) · Rocky Linux / RHEL / AlmaLinux 9.x (Ceph host baseline) · Proxmox VE 9.x (cross-course integration) · Kubernetes 1.31+ (cross-course integration) · 2026-08-18

Why this matters in production

Protection exists to stop you destroying the data a hundred clones are reading from. It also becomes the obstacle when a template must be retired, and understanding it as a dependency lock rather than an attribute makes both behaviours predictable.

Protecting

rbd snap create   rbd-templates/ubuntu-2404@v1
rbd snap protect  rbd-templates/ubuntu-2404@v1
rbd snap ls       rbd-templates/ubuntu-2404
# SNAPID  NAME  SIZE    PROTECTED  TIMESTAMP
#      7  v1    40 GiB  yes        2026-08-18T09:14:22

A protected snapshot cannot be deleted and cannot be rolled back to. Both restrictions exist because clones depend on its exact contents.

rbd clone rbd-templates/ubuntu-2404@v1 rbd-vms/web-01
# fails if the snapshot is not protected

Why the restriction is necessary

A clone stores only what it has written; everything else reads from the parent snapshot. If the snapshot could be deleted, every clone would lose the data it had not yet written — an immediate, silent, unrecoverable corruption across every dependent image.

Rollback is blocked for the same reason: it would change the snapshot’s effective contents underneath the clones.

Unprotecting

rbd snap unprotect rbd-templates/ubuntu-2404@v1
# Error: cannot unprotect: at least 1 child(ren) [web-01] in pool 'rbd-vms'

rbd children rbd-templates/ubuntu-2404@v1
# rbd-vms/web-01
# rbd-vms/web-02

Every child must be flattened or deleted first:

for c in $(rbd children rbd-templates/ubuntu-2404@v1); do
  rbd flatten "$c"
done
rbd snap unprotect rbd-templates/ubuntu-2404@v1
rbd snap rm rbd-templates/ubuntu-2404@v1

Template versioning

The workflow that keeps this manageable:

# new template version, side by side with the old
rbd snap create  rbd-templates/ubuntu-2404@v2
rbd snap protect rbd-templates/ubuntu-2404@v2

# new provisioning uses v2; existing v1 clones are untouched
rbd clone rbd-templates/ubuntu-2404@v2 rbd-vms/web-03

# retire v1 once its children are gone
rbd children rbd-templates/ubuntu-2404@v1   # empty?
rbd snap unprotect rbd-templates/ubuntu-2404@v1
rbd snap rm rbd-templates/ubuntu-2404@v1

Keeping several protected versions is normal and cheap. Keeping an unbounded number of them is how a template pool becomes impossible to reason about — cap the number of live versions as a policy.

Quiz

Knowledge check · 4 questions

Q1. Why can a protected snapshot not be rolled back to?

Rollback is never supported on an image that has been used as a clone template Protection makes the whole image read-only, rather than just the snapshot Rollback requires the image to hold no snapshots at all other than the one being rolled back to It would change the snapshot's effective contents beneath the clones that depend on them
Q2. Protecting a snapshot that has no clones makes the protected flag less useful rather than more.

True False
Q3. Manage a template version transition.

A platform provisions from `ubuntu-2404@v1`, which has 180 clones. A new version v2 is ready with security updates. Existing VMs must not be disturbed, and v1 must eventually be retired for compliance.
Q4. How does clone v2 change the template retirement workflow?

Passing score: 75%. Answers are checked in this browser.

Production discipline

Treat protection as a dependency indicator and keep it off snapshots that have no clones, so the flag remains informative. Cap the number of live template versions as policy and track child counts per version — that number is what makes retirement a scheduled task rather than an open-ended search.

Cross-course references

Kubernetes: a VolumeSnapshot in use by a PVC has the same deletion-blocking dependency
Linux: a mounted filesystem blocking device removal is the same protective refusal